124 Responses

Too messy.Too complicated.Nothing to see here, move alongMore handwavium from that nice Mr Key.Where's my tax cut?I can't see this issue going anywhere, would like to be proved wrong of course but very much doubt it.Followed by weary sigh.

"First of all it would be illegal if we were doing that and we don’t act outside the framework of the law, that’s a really important point to start with”.

Which sadly when spoken by an intelligence chief of a five eyes nation nowadays simply brings to mind the old observation that the Nazis never acted outside the framework of the law, either.

"The kind of security I am referring to is not censorship, nor really anything to do with content. Rather it is the kind of framework of law and order, supporting our ability to go about a lawful business, which we have built up so painstakingly and painfully in the analogue world, really since civilizations began."

Which sound awfully like justifying the use of surveillance allowed under anti-terror laws to chase copyright and intellectual property criminals, whom presumably our little Yankee lap dogs are more than happy to re-designate as terrorists. After all, you send a squad car to arrest a copyright infringer who fails to appear in court after a summons. You launch a helicopter raid on a terrorist’s mansion.

Anyway, I have absolutely no doubt our GCSB is as guilty of surveillance over-reach as all the other intelligence gathering agencies in the five eyes countries have been proved to be. The GCSB would never wanted to have been exempted from taking part in mass surveillance. Why would you trust their denials now? The British and Americans and Canadians lied repeatedly about their spying, lying then constantly exposed by Snowden’s revelations. They are all part of the five eye hive mind, behaving like a federation of deep states. If there is one thing we know about the culture of our intelligence community and their minister it is they all desperately want to be in the United States cool kids club. I have zero doubt that Fletcher’s words contain (for him at least) some sort of mendacious weasel words rationale that will allow to claim he wasn’t lying when the truth comes out. And it will come out, eventually. In a democracy you can't keep all the spooks silent all the time. Just ask Edward Snowden.

Discussing it at home last night, we decided that basically it was going to mean the GCSB mandating use of routers/Network configurations that were compromisable by the NSA or GCSB. I'd bet that if a network provider found a way to firewall off any command/control signals from outside their network, the GCSB would tell them to stop.

There doesn't seem to be a way to avoid being observed, sorted, classified and profiled without giving up on modern life.

Given the capabilities listed, and the volume of events captured, it's almost impossible to believe that lots of data about NZ citizens was not recorded.

As Tom has suggested, there's a smugness and arrogance in the slidepacks that deeply disturbs me. The Yanks and the Brits and the Aussies have overreached their legal powers and lied about it and been caught. While I would like to believe that our own spooks are squeaky clean, I think that Ian Fletcher is deliberatly misleading us, if not flat-out lying.

It's quite clear from the documentation that thees capabilities are being used for diplomatic advantage and financial advantage of US corporations.

* they were briefed on the NSA's efforts to deliberately put backdoors into private companies' computer networks;

"Has it or would it?" well, the answer to that is "Hell yes" and Xion Qui would know that, even though he would "reject that accusation" or call it "More nonsense from the loony left" or some such twaddle as he is prone to do.It seems all this bunch of power hungry greed heads just have to do is deny inconvenient facts and they go away.The gullibility of the New Zealand public fills me with despair and anger, wake up sheeple.

Wake up... and demand our spy services are closed down pending a fully independent review and possibly new entities formed that serve us not some foreign interests - I think we're safe from invasion or whatever the hell they protect us from in the interim

By coincidence, this week the GCSB and the National Cyber Security Centre (NCSC) released their “guidance” for New Zealand network operators, which sets out the expectations under the Telecommunications (Interception Capability and Security) Act, which passed last year.

I'm interested in how this is going to work at a practical level. The guidelines themselves are quite broad, suggesting that if a network operator isn't sure whether a change is notifiable, they should contact the NCSC to check. This is going to result in a lot of notifications initially, at least until network operators iron out the process. (There is also no mention of timeframes, which could mean serious delays are on the cards for a while.)

For traditional telcos, notifiable changes won't be terribly frequent, but with VOIP services becoming more common, and with the flexibility (and corresponding ad hoc nature) of VOIP setups, I think we'll see notifiable events skyrocket in the next few years. Some providers will be good at notifying these events, but others won't even realize they need to.

I don't think exploitation of existing hardware/software exploits by agencies will increase under TICSA-if telcos are unaware of agencies using backdoors, there's nothing stopping them from fixing/patching them as soon as they become known in the industry, which is something that happens regularly. But installation of backdoors that network operators know about is the entire point of TICSA, so we'll see a lot more of that. Whether we see push back from network operators if they feel interception requests are too broad or too invasive...well, that's where things could get interesting.

This whole "GCSB must approve all changes to your network" and "all your employees must receive a security clearance" worries me a lot - (does NZ actually have security clearances? I guess we'll all need them now).

I design telecommunications systems, will I get a GCSB minder to look over my shoulder all day in case I invent a system that the NSA can't break into?

Discussing it at home last night, we decided that basically it was going to mean the GCSB mandating use of routers/Network configurations that were compromisable by the NSA or GCSB. I’d bet that if a network provider found a way to firewall off any command/control signals from outside their network, the GCSB would tell them to stop

I'm confident that interception won't occur at that level, because it doesn't need to. There is a vast range of different equipment and protocols in use in NZ at the moment, and no way for any government to regulate it effectively. Interception will occur at someone's desk at your ISP, with your ISP's knowledge and agreement. This isn't a technology issue, it's a people issue.

Therein lies a big part of the problem. In a word where technology was sold to us on the basis that it would make our lives “better” and that we would have more leisure time, we actually find the opposite happening, we have less time, we are working our fingers to the bone just to end up with nothing but bony fingers.Perhaps the real answer here is to not play their game, start writing letters to each other again, have more social gatherings and spend less time chasing the almighty dollar, wake up, use your noses to smell the roses and less for chasing “supposes”He proposes as he poses then mosies to where he dozes…

Not as the USA does, where you get vetted and it stays with you as an individual. Generally, security clearances apply only to staff of a government organisation and are the decision of the Chief Executive of that agency and only for that agency. For Restricted or Confidential, that's all you need. For higher levels (there are four - RESTRICTED, CONFIDENTIAL, SECRET and TOP SECRET) you may need to be vetted by the SIS. I'm not aware of how they manage this for individuals who are not government employees, but having a clearance at one agency doesn't mean you can see material at the same level at another agency, so I imagine non-employees are at the CE's discretion as well.

See Security in the Government Sector [pdf] on the SIS site for the mind-numbingly boring detail. [disclaimer - I didn't write it but I used to sit next to the guy that did]

(does NZ actually have security clearances? I guess we'll all need them now).

Yes - they're required for work in certain government positions (e.g. MFAT, Defence, spies, and some parts of Treasury, SSC, DPMC, police, customs, and immigration). There's a candidate guide here.

Requiring such clearance for appropriate government work is one thing. But demanding it of civilians who have nothing to do with the government (and potentially being able to shut down an entire business if they don't jump through your stupid hoops) is intrusive and onerous.

OTOH, if you don't want to play, just tell them that you're a drug-addicted communist wikileaks-supporter with huge financial problems who is cheating on your partner (that establishes three of the classic motives: Money, Ideology, Compromise). Problem solved.

Requiring such clearance for appropriate government work is one thing. But demanding it of civilians who have nothing to do with the government (and potentially being able to shut down an entire business if they don’t jump through your stupid hoops) is intrusive and onerous.

Many people in telecommunications are very unhappy about all this. Understandably.